CVE-2023-38302 Information disclosure in n/a
Local apps can read Wi-Fi and Bluetooth MAC addresses from system properties, bypassing Android privacy restrictions on device identifiers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38302?
CVE-2023-38302 is a medium-severity vulnerability in n/a, published on 22 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leaks the Wi-Fi MAC address and the Bluetooth MAC address to system properties that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in this instance they are leaked by a high-privilege process and can be obtained indirectly. This malicious app reads from the "ro.boot.wifi_mac" system property to indirectly obtain the Wi-Fi MAC address and reads the "ro.boot.bt_mac" system property to obtain the Bluetooth MAC address.
Weakness: CWE-200
Which versions are affected by CVE-2023-38302?
How do I fix CVE-2023-38302?
No fix has been published for CVE-2023-38302 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38302 being exploited?
There is no known exploitation of CVE-2023-38302 in the wild and no public exploit code.
Sources
Also known as GHSA-843f-6jw5-wr67.